Hyperion Financial Management CVE-2026-87186

Exploitation requires the attacker to have access to the physical communication segment (same adjacent L2 network/broadcast domain) attached to the hardware running Oracle Hyperion Financial Management 11.2.26.0.000 - remote internet-only exploitation is NOT possible (AV:A). Within that constraint, no authentication is required (PR:N) and no user interaction is needed (UI:N), and it targets the default Security component. The primary limiting factor is network adjacency: defenders can materially reduce risk by isolating/segmenting the HFM host so untrusted systems cannot share its communication segment. The scope change (S:C) means successful compromise can extend impact beyond HFM to other products reachable from it.

This is a genuinely high-severity flaw but with an important real-world limiter that the raw 9.6 score obscures. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an unauthenticated, low-complexity, no-user-interaction attack yielding full compromise (confidentiality, integrity, and availability) with a scope change into adjacent products. The critical qualifier is AV:A (Adjacent), not AV:N: Oracle's own description states the attacker needs 'access to the physical communication segment attached to the hardware' - i.e., the attacker must already be on the same L2/broadcast segment, not exploiting freely across the internet. That single metric is what drops it from a hypothetical 9.8/10.0 and is the key differentiator from Oracle's network-vector Hyperion siblings this cycle. On the exploitation-likelihood side, all opportunistic signals are absent: no CISA KEV listing, no known public proof-of-concept, and no EPSS score in the provided data - so there is no evidence of active or automatable mass exploitation. The scope-change (S:C) plus full-triad impact makes technical impact 'total,' which is what keeps priority high despite the adjacency gate. Net: this is a real priority for organizations that run Hyperion in flat/shared network segments, but it is not an internet-exposed wormable emergency; the adjacency requirement makes realistic exploitation targeted (an attacker with an existing network foothold) rather than widespread.

An attacker who has already gained a foothold on the local network segment hosting the Hyperion Financial Management server (e.g., via a compromised adjacent host or malicious insider) sends crafted traffic to the HFM Security component without needing any credentials or user interaction. Because the flaw allows a scope change, successful exploitation takes over HFM and may pivot to impact additional connected products. No public exploit code has been identified at time of analysis, so exploitation would require attacker-developed tooling.